danabot | a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0

General

Target

2d673fcd210cfad92825862e017eaa09.exe
Size

2.8MB
MD5

2d673fcd210cfad92825862e017eaa09
SHA1

531ac29cd36abba042f352983d9fcde29a987473
SHA256

a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0
SHA512

bac7a6decd497e06f4670b8439f830c9dbfdcfb5f9862f0304792f88748a6ebbf64d00c13ca512f85887c9f5608249b7bb642da1ff8c6d324400bacd86d741b0

Score

10^/10

danabot banker botnet trojan

Malware Config

Extracted

Family

danabot

C2

37.120.145.180

95.174.65.203

51.77.7.204

192.236.160.191

193.34.167.174

185.227.138.47

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot x86 payload 6 IoCs

Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

botnet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL	family_danabot

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
2	1196	rundll32.exe
3	1196	rundll32.exe
6	1196	rundll32.exe
7	1196	rundll32.exe
8	1196	rundll32.exe
9	1196	rundll32.exe
10	1196	rundll32.exe
11	1196	rundll32.exe
12	1196	rundll32.exe
13	1196	rundll32.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exerundll32.exe

pid process

1616 regsvr32.exe
1196 rundll32.exe
1196 rundll32.exe
1196 rundll32.exe
1196 rundll32.exe

pid	process
1616	regsvr32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe
1196	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2d673fcd210cfad92825862e017eaa09.exeregsvr32.exe

description	pid	process	target process
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1700 wrote to memory of 1616	1700	2d673fcd210cfad92825862e017eaa09.exe	regsvr32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe
PID 1616 wrote to memory of 1196	1616	regsvr32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\2d673fcd210cfad92825862e017eaa09.exe
"C:\Users\Admin\AppData\Local\Temp\2d673fcd210cfad92825862e017eaa09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\2D673F~1.EXE@1700
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL,f0
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
9ba780138ffe7c27d34d05fcc577194d

SHA1
ce0efa3d8fd4cdd7274502a4b63e76007df91daa

SHA256
9169eacf0f33f251a5aa0487b1c3ae86fb81f36d2f023d7e61ed707e3d01442f

SHA512
79fcc829f0dd8e7d09c586007df3e7af85327690e53b5ead3a52e2a7867e2f096b3ba507942595ced95be6aa58c11fa819995df7a3842e5ed7691f0797b133a1

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
9ba780138ffe7c27d34d05fcc577194d

SHA1
ce0efa3d8fd4cdd7274502a4b63e76007df91daa

SHA256
9169eacf0f33f251a5aa0487b1c3ae86fb81f36d2f023d7e61ed707e3d01442f

SHA512
79fcc829f0dd8e7d09c586007df3e7af85327690e53b5ead3a52e2a7867e2f096b3ba507942595ced95be6aa58c11fa819995df7a3842e5ed7691f0797b133a1

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
9ba780138ffe7c27d34d05fcc577194d

SHA1
ce0efa3d8fd4cdd7274502a4b63e76007df91daa

SHA256
9169eacf0f33f251a5aa0487b1c3ae86fb81f36d2f023d7e61ed707e3d01442f

SHA512
79fcc829f0dd8e7d09c586007df3e7af85327690e53b5ead3a52e2a7867e2f096b3ba507942595ced95be6aa58c11fa819995df7a3842e5ed7691f0797b133a1

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
9ba780138ffe7c27d34d05fcc577194d

SHA1
ce0efa3d8fd4cdd7274502a4b63e76007df91daa

SHA256
9169eacf0f33f251a5aa0487b1c3ae86fb81f36d2f023d7e61ed707e3d01442f

SHA512
79fcc829f0dd8e7d09c586007df3e7af85327690e53b5ead3a52e2a7867e2f096b3ba507942595ced95be6aa58c11fa819995df7a3842e5ed7691f0797b133a1

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
9ba780138ffe7c27d34d05fcc577194d

SHA1
ce0efa3d8fd4cdd7274502a4b63e76007df91daa

SHA256
9169eacf0f33f251a5aa0487b1c3ae86fb81f36d2f023d7e61ed707e3d01442f

SHA512
79fcc829f0dd8e7d09c586007df3e7af85327690e53b5ead3a52e2a7867e2f096b3ba507942595ced95be6aa58c11fa819995df7a3842e5ed7691f0797b133a1

Download Submit
\Users\Admin\AppData\Local\Temp\2D673F~1.DLL
MD5
9ba780138ffe7c27d34d05fcc577194d

SHA1
ce0efa3d8fd4cdd7274502a4b63e76007df91daa

SHA256
9169eacf0f33f251a5aa0487b1c3ae86fb81f36d2f023d7e61ed707e3d01442f

SHA512
79fcc829f0dd8e7d09c586007df3e7af85327690e53b5ead3a52e2a7867e2f096b3ba507942595ced95be6aa58c11fa819995df7a3842e5ed7691f0797b133a1

Download Submit
memory/1196-5-0x0000000000000000-mapping.dmp

Download
memory/1616-2-0x0000000000000000-mapping.dmp

Download
memory/1700-0-0x0000000002760000-0x00000000029D7000-memory.dmp

Filesize
2.5MB

Download
memory/1700-1-0x00000000029E0000-0x00000000029F1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads